3 people c8bad9b26b fix(posting-guard): remove, count and flag Unicode tag characters (#702) ...

* fix(posting-guard): remove, count and flag Unicode tag characters

The invisible-character set covered zero-width, bidi, soft hyphen and
BOM but not U+E0000-U+E007F, the "tags" block: one invisible code point
per ASCII character, which renders as nothing and is read by a model as
the ASCII it mirrors. A posting carrying "Ignore all previous
instructions" written in that block got the clean verdict through the
documented --text --json call, and the characters survived into the
cleaned text the agent reads; a single tag character inside "ignore"
also split the word past every instruction pattern.

Strip the block with the other invisibles, count it under
invisible_chars.tag, and always raise the warning, because no legitimate
posting contains one. Two new cases; both fail on master.

* changelog: place the #702 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-21 07:16:17 +02:00

..

check_framework_version.py

fix(framework-version): distinguish marker changes from YAML formatting (#578)

2026-10-18 07:36:13 +02:00

check_upstream_updates.py

fix(upstream): avoid all-clear after a failed fetch (#681)

2026-10-19 21:45:13 +02:00

convert_salary_excel.py

fix(salary): never take a qualified salary header as the company column (#700)

2026-10-21 07:12:41 +02:00

fetch_page.py

fix(fetch-page): check robots policy before each redirect (#680)

2026-10-21 07:06:40 +02:00

install_portal_clis.py

feat(tools): install every discovered portal CLI with one command (#540) (#541)

2026-10-15 11:32:17 +02:00

job_key.py

fix(job-key): report a non-string url in --audit instead of a traceback (#634)

2026-10-19 19:30:01 +02:00

lint_skills.py

fix(lint): report malformed settings shapes without crashing (#146)

2026-07-13 20:45:22 +02:00

page_decode.py

fix(tools): decode saved non-UTF-8 pages by their declared charset (#690)

2026-10-20 08:28:58 +02:00

posting_guard.py

fix(posting-guard): remove, count and flag Unicode tag characters (#702)

2026-10-21 07:16:17 +02:00

rank_state.py

fix(rank): keep every --exclude key out of the sweep when the list has spaces (#641)

2026-10-19 19:49:24 +02:00

README_SALARY_TOOL.md

fix(salary): validate category shape and add --validate preflight (#156)

2026-07-15 07:53:01 +02:00

robots_check.py

fix(tools): force UTF-8 output on fetch_page & robots_check (closes #685) (#686)

2026-10-19 21:46:48 +02:00

security_guards.py

chore(guards): trim a stray clause from the own-CLI grant comment

2026-10-19 17:34:29 +02:00

upstream_triage.py

fix(upstream-triage): skip new upstream files inside a directory the fork removed (#656)

2026-10-19 20:04:43 +02:00

verify_layout.py

fix(verify-layout): walk PATH candidates for pdftotext supporting -bbox (#655) (#668)

2026-10-19 20:07:50 +02:00

verify_pdf.py

fix(verify_pdf): --ascii-dates catches the 2016–17 form again (regression in #533) (#698)

2026-10-20 21:00:46 +02:00